+
+👋 Looking to report an issue? We're managing issues for this plugin using our [bug report wizard](https://pavilion.tech/products/discourse-custom-wizard-plugin/support/bug-report).
+
+## Install
+
+If you're not sure how to install a plugin in Discourse, please follow the [plugin installation guide](https://meta.discourse.org/t/install-a-plugin/19157) or contact your Discourse hosting provider.
+
+## Documentation
+
+[Read the full documentation here](https://pavilion.tech/products/discourse-custom-wizard-plugin/documentation/), or go directly to the relevant section
+
+- [Wizard Administration](https://coop.pavilion.tech/t/1602)
+- [Wizard Settings](https://coop.pavilion.tech/t/1614)
+- [Step Settings](https://pavilion.tech/products/discourse-custom-wizard-plugin/documentation/step-settings)
+- [Field Settings](https://pavilion.tech/products/discourse-custom-wizard-plugin/documentation/field-settings)
+- [Conditional Settings](https://pavilion.tech/products/discourse-custom-wizard-plugin/documentation/conditional-settings)
+- [Field Interpolation](https://pavilion.tech/products/discourse-custom-wizard-plugin/documentation/field-interpolation)
+- [Handling Dates and Times](https://coop.pavilion.tech/t/1708)
+
+## Support
+
+- [Report an issue](https://pavilion.tech/products/discourse-custom-wizard-plugin/support/bug-report)
+
+## Statistics
+
+For improved service and development, this plugin collects some generalised quantitative data related to version and usage. No personal or sensitive information is gathered. Please email contact@pavilion.tech if you have any questions or concerns about our data collection.
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..c799fa5a
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,7 @@
+# Security Policy
+
+The security of Discourse plugins are premised on the security of [Discourse](https://github.com/discourse/discourse). Please first consider whether a security issue is best reported and handled by the Discourse team. You can view the Discourse security policy [here](https://github.com/discourse/discourse/security/policy).
+
+## Reporting a Vulnerability
+
+If you find a security vulnerability that is specific to this plugin, please report it to development@pavilion.tech. Security issues always take precedence over all other work. All commits specific to security are prefixed with SECURITY.
diff --git a/app/controllers/custom_wizard/admin/admin.rb b/app/controllers/custom_wizard/admin/admin.rb
index c99954d6..2b950b23 100644
--- a/app/controllers/custom_wizard/admin/admin.rb
+++ b/app/controllers/custom_wizard/admin/admin.rb
@@ -2,9 +2,6 @@
class CustomWizard::AdminController < ::Admin::AdminController
before_action :ensure_admin
- def index
- end
-
private
def find_wizard
diff --git a/app/controllers/custom_wizard/admin/api.rb b/app/controllers/custom_wizard/admin/api.rb
index a913e9ca..e4ac31e9 100644
--- a/app/controllers/custom_wizard/admin/api.rb
+++ b/app/controllers/custom_wizard/admin/api.rb
@@ -20,6 +20,10 @@ class CustomWizard::AdminApiController < CustomWizard::AdminController
raise Discourse::InvalidParameters, "An API with that name already exists: '#{current.title || current.name}'"
end
+ unless subscription.includes?(:api, :all)
+ raise Discourse::InvalidParameters, "Your subscription doesn't include API features."
+ end
+
PluginStoreRow.transaction do
CustomWizard::Api.set(api_params[:name], title: api_params[:title])
@@ -130,4 +134,8 @@ class CustomWizard::AdminApiController < CustomWizard::AdminController
@auth_data ||= auth_data
end
+
+ def subscription
+ @subscription ||= CustomWizard::Subscription.new
+ end
end
diff --git a/app/controllers/custom_wizard/admin/custom_fields.rb b/app/controllers/custom_wizard/admin/custom_fields.rb
index c52759c9..111e9faf 100644
--- a/app/controllers/custom_wizard/admin/custom_fields.rb
+++ b/app/controllers/custom_wizard/admin/custom_fields.rb
@@ -1,7 +1,9 @@
# frozen_string_literal: true
class CustomWizard::AdminCustomFieldsController < CustomWizard::AdminController
def index
- render_json_dump(custom_field_list)
+ render_json_dump(
+ custom_fields: custom_field_list
+ )
end
def update
diff --git a/app/controllers/custom_wizard/admin/logs.rb b/app/controllers/custom_wizard/admin/logs.rb
index 976814f8..7ca37bb2 100644
--- a/app/controllers/custom_wizard/admin/logs.rb
+++ b/app/controllers/custom_wizard/admin/logs.rb
@@ -1,9 +1,44 @@
# frozen_string_literal: true
class CustomWizard::AdminLogsController < CustomWizard::AdminController
+ before_action :find_wizard, except: [:index]
+
def index
- render_serialized(
- CustomWizard::Log.list(params[:page].to_i, params[:limit].to_i),
- CustomWizard::LogSerializer
+ render json: ActiveModel::ArraySerializer.new(
+ CustomWizard::Wizard.list(current_user),
+ each_serializer: CustomWizard::BasicWizardSerializer
)
end
+
+ def show
+ render_json_dump(
+ wizard: CustomWizard::BasicWizardSerializer.new(@wizard, root: false),
+ logs: ActiveModel::ArraySerializer.new(
+ log_list.logs,
+ each_serializer: CustomWizard::LogSerializer
+ ),
+ total: log_list.total
+ )
+ end
+
+ protected
+
+ def log_list
+ @log_list ||= begin
+ list = CustomWizard::Log.list(params[:page].to_i, params[:limit].to_i, params[:wizard_id])
+
+ if list.logs.any? && (usernames = list.logs.map(&:username)).present?
+ user_map = User.where(username: usernames)
+ .reduce({}) do |result, user|
+ result[user.username] = user
+ result
+ end
+
+ list.logs.each do |log_item|
+ log_item.user = user_map[log_item.username]
+ end
+ end
+
+ list
+ end
+ end
end
diff --git a/app/controllers/custom_wizard/admin/submissions.rb b/app/controllers/custom_wizard/admin/submissions.rb
index 4cb2a0e4..d5994c96 100644
--- a/app/controllers/custom_wizard/admin/submissions.rb
+++ b/app/controllers/custom_wizard/admin/submissions.rb
@@ -13,12 +13,21 @@ class CustomWizard::AdminSubmissionsController < CustomWizard::AdminController
def show
render_json_dump(
wizard: CustomWizard::BasicWizardSerializer.new(@wizard, root: false),
- submissions: ActiveModel::ArraySerializer.new(ordered_submissions, each_serializer: CustomWizard::SubmissionSerializer)
+ submissions: ActiveModel::ArraySerializer.new(
+ submission_list.submissions,
+ each_serializer: CustomWizard::SubmissionSerializer
+ ),
+ total: submission_list.total
)
end
def download
- send_data ordered_submissions.to_json,
+ content = ActiveModel::ArraySerializer.new(
+ CustomWizard::Submission.list(@wizard).submissions,
+ each_serializer: CustomWizard::SubmissionSerializer
+ )
+
+ send_data content.to_json,
filename: "#{Discourse.current_hostname}-wizard-submissions-#{@wizard.name}.json",
content_type: "application/json",
disposition: "attachment"
@@ -26,7 +35,7 @@ class CustomWizard::AdminSubmissionsController < CustomWizard::AdminController
protected
- def ordered_submissions
- CustomWizard::Submission.list(@wizard, order_by: 'id')
+ def submission_list
+ CustomWizard::Submission.list(@wizard, page: params[:page].to_i)
end
end
diff --git a/app/controllers/custom_wizard/admin/subscription.rb b/app/controllers/custom_wizard/admin/subscription.rb
new file mode 100644
index 00000000..7b596ec6
--- /dev/null
+++ b/app/controllers/custom_wizard/admin/subscription.rb
@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+class CustomWizard::SubscriptionController < ::Admin::AdminController
+ before_action :ensure_admin
+
+ def index
+ if params[:update_from_remote]
+ subscription = CustomWizard::Subscription.new(true)
+ else
+ subscription = CustomWizard::Subscription.new
+ end
+
+ render_json_dump(
+ subscribed: subscription.subscribed?,
+ subscription_type: subscription.type,
+ subscription_attributes: CustomWizard::Subscription.attributes,
+ )
+ end
+end
diff --git a/app/controllers/custom_wizard/admin/wizard.rb b/app/controllers/custom_wizard/admin/wizard.rb
index 0a59e02b..08e7b6d0 100644
--- a/app/controllers/custom_wizard/admin/wizard.rb
+++ b/app/controllers/custom_wizard/admin/wizard.rb
@@ -88,6 +88,7 @@ class CustomWizard::AdminWizardController < CustomWizard::AdminController
:title,
:key,
:banner,
+ :banner_upload_id,
:raw_description,
:required_data_message,
:force_final,
@@ -99,6 +100,7 @@ class CustomWizard::AdminWizardController < CustomWizard::AdminController
:index,
:label,
:image,
+ :image_upload_id,
:description,
:required,
:key,
@@ -112,6 +114,7 @@ class CustomWizard::AdminWizardController < CustomWizard::AdminController
:property,
:preview_template,
:placeholder,
+ :can_create_tag,
prefill: mapped_params,
content: mapped_params,
condition: mapped_params,
@@ -161,7 +164,9 @@ class CustomWizard::AdminWizardController < CustomWizard::AdminController
mentionable_level: mapped_params,
messageable_level: mapped_params,
visibility_level: mapped_params,
- members_visibility_level: mapped_params
+ members_visibility_level: mapped_params,
+ add_event: mapped_params,
+ add_location: mapped_params
]
)
end
diff --git a/app/controllers/custom_wizard/steps.rb b/app/controllers/custom_wizard/steps.rb
index df3c2cb3..2a4305c7 100644
--- a/app/controllers/custom_wizard/steps.rb
+++ b/app/controllers/custom_wizard/steps.rb
@@ -1,6 +1,5 @@
# frozen_string_literal: true
-class CustomWizard::StepsController < ::ApplicationController
- before_action :ensure_logged_in
+class CustomWizard::StepsController < ::CustomWizard::WizardClientController
before_action :ensure_can_update
def update
@@ -22,7 +21,7 @@ class CustomWizard::StepsController < ::ApplicationController
if updater.success?
wizard_id = update_params[:wizard_id]
- builder = CustomWizard::Builder.new(wizard_id, current_user)
+ builder = CustomWizard::Builder.new(wizard_id, current_user, guest_id)
@wizard = builder.build(force: true)
current_step = @wizard.find_step(update[:step_id])
@@ -85,7 +84,6 @@ class CustomWizard::StepsController < ::ApplicationController
private
def ensure_can_update
- @builder = CustomWizard::Builder.new(update_params[:wizard_id], current_user)
raise Discourse::InvalidParameters.new(:wizard_id) if @builder.template.nil?
raise Discourse::InvalidAccess.new if !@builder.wizard || !@builder.wizard.can_access?
diff --git a/app/controllers/custom_wizard/wizard.rb b/app/controllers/custom_wizard/wizard.rb
index bb53670b..dd4ea4ca 100644
--- a/app/controllers/custom_wizard/wizard.rb
+++ b/app/controllers/custom_wizard/wizard.rb
@@ -1,39 +1,10 @@
# frozen_string_literal: true
-class CustomWizard::WizardController < ::ActionController::Base
- helper ApplicationHelper
-
- include CurrentUser
- include CanonicalURL::ControllerExtensions
- include GlobalPath
-
- prepend_view_path(Rails.root.join('plugins', 'discourse-custom-wizard', 'app', 'views'))
- layout :set_wizard_layout
-
- before_action :preload_wizard_json
- before_action :ensure_plugin_enabled
- before_action :ensure_logged_in, only: [:skip]
-
- helper_method :wizard_page_title
- helper_method :wizard_theme_id
- helper_method :wizard_theme_lookup
- helper_method :wizard_theme_translations_lookup
-
- def set_wizard_layout
- action_name === 'qunit' ? 'qunit' : 'wizard'
- end
-
- def index
- respond_to do |format|
- format.json do
- if wizard.present?
- render json: CustomWizard::WizardSerializer.new(wizard, scope: guardian, root: false).as_json, status: 200
- else
- render json: { error: I18n.t('wizard.none') }
- end
- end
- format.html do
- render "default/empty"
- end
+class CustomWizard::WizardController < ::CustomWizard::WizardClientController
+ def show
+ if wizard.present?
+ render json: CustomWizard::WizardSerializer.new(wizard, scope: guardian, root: false).as_json, status: 200
+ else
+ render json: { error: I18n.t('wizard.none') }
end
end
@@ -57,69 +28,12 @@ class CustomWizard::WizardController < ::ActionController::Base
render json: result
end
- def qunit
- raise Discourse::InvalidAccess.new if Rails.env.production?
-
- respond_to do |format|
- format.html do
- render "default/empty"
- end
- end
- end
-
protected
- def ensure_logged_in
- raise Discourse::NotLoggedIn.new unless current_user.present?
- end
-
- def guardian
- @guardian ||= Guardian.new(current_user, request)
- end
-
def wizard
@wizard ||= begin
- builder = CustomWizard::Builder.new(params[:wizard_id].underscore, current_user)
- return nil unless builder.present?
- opts = {}
- opts[:reset] = params[:reset]
- builder.build(opts, params)
- end
- end
-
- def wizard_page_title
- wizard ? (wizard.name || wizard.id) : I18n.t('wizard.custom_title')
- end
-
- def wizard_theme_id
- wizard ? wizard.theme_id : nil
- end
-
- def wizard_theme_lookup(name)
- Theme.lookup_field(wizard_theme_id, view_context.mobile_view? ? :mobile : :desktop, name)
- end
-
- def wizard_theme_translations_lookup
- Theme.lookup_field(wizard_theme_id, :translations, I18n.locale)
- end
-
- def preload_wizard_json
- return if request.xhr? || request.format.json?
- return if request.method != "GET"
-
- store_preloaded("siteSettings", SiteSetting.client_settings_json)
- end
-
- def store_preloaded(key, json)
- @preloaded ||= {}
- @preloaded[key] = json.gsub("
-
- <%= discourse_color_scheme_stylesheets %>
-
- <%= discourse_stylesheet_link_tag :wizard, theme_id: nil %>
- <%= discourse_stylesheet_link_tag :wizard_custom %>
- <%- if wizard_theme_id.present? %>
- <%= discourse_stylesheet_link_tag (mobile_view? ? :mobile_theme : :desktop_theme), theme_id: wizard_theme_id %>
- <%- end %>
-
- <%= preload_script "locales/#{I18n.locale}" %>
- <%= preload_script "ember_jquery" %>
- <%= preload_script "wizard-vendor" %>
- <%= preload_script "wizard-custom" %>
- <%= preload_script "wizard-raw-templates" %>
- <%= preload_script "wizard-plugin" %>
- <%= preload_script "pretty-text-bundle" %>
-
- <%= csrf_meta_tags %>
-
- <%- unless customization_disabled? %>
- <%= wizard_theme_translations_lookup %>
- <%= raw wizard_theme_lookup("head_tag") %>
- <%- end %>
-
- <%= server_plugin_outlet "custom_wizard" %>
-
- <%= tag.meta id: 'data-discourse-setup', data: client_side_setup_data %>
-
-
-
-
- <%= render partial: "layouts/head" %>
-